v1.5.0: worktree post-add hook + dependency policy

Devbox Anywhere v1.5.0 — worktree post-add hook + dependency policy

Addresses the first practical snag from real use: a freshly created agent worktree has no installed dependencies, so an agent dropped into it hits missing-dependency errors.

What's new

• DEVBOX_WORKTREE_POSTADD hook — an optional command run inside the new worktree right after the agent is created, so dependencies install automatically:

  DEVBOX_WORKTREE_POSTADD='npm ci' devbox-worktree add webapp webapp-api

  If the hook fails, add exits non-zero but keeps the worktree, branch, and registration, so you can fix the environment and re-run the install without recreating the agent.
• docs/13 "Dependency policy" — install dependencies per worktree; explicitly warns against sharing node_modules/venv across worktrees (native-module corruption, install races, invisible lockfile drift), and suggests a content-addressed store (pnpm, uv cache) if disk or install time is a concern.

Scope

Only scripts/devbox-worktree changes at runtime (the new post-add path); the installer, harness, and other helpers are unchanged from v1.4.1.

Testing

• Full canonical suite green; 39/39 named mutation reds (incl. a new red proving a failing hook is surfaced, not swallowed).
• Live helper-slice smoke PASS on Ubuntu 24.04 x86_64 / Docker 29.1.3 / Compose v2.40.3, against a real v1.4.1 base install: the hook runs with cwd = the new worktree, a failing hook exits non-zero while keeping the worktree + registration, and the no-hook path is unchanged.

No known blockers within the reviewed and tested scope. Base: v1.4.1 (1e50295).